audit-code -- Project Code Security Review
Security-focused code review of project source code. Covers OWASP-style vulnerabilities, hardcoded secrets, dangerous function calls, and patterns relevant to AI-assisted development.
What to do
Run the auditor against the target path:
python3 "$SKILL_DIR/scripts/audit_code.py" "$ARGUMENTS"
If $ARGUMENTS is empty, default to $PROJECT_ROOT.
What it checks
- Hardcoded secrets -- API keys (AWS, GitHub, Stripe, OpenAI, Slack), tokens, private keys, connection strings, passwords
- Dangerous function calls -- eval, exec, subprocess with shell=True, child_process.exec, pickle deserialization, system(), gets(), etc.
- SQL injection -- String concatenation/interpolation in SQL queries
- Dependency risks -- Known hallucinated package names, unverified installations
- Sensitive files -- .env files committed to git, credential files in repo
- File permissions -- Overly permissive chmod patterns
- Exfiltration patterns -- Base64 encode + network send, DNS exfiltration, credential file reads
Output
Structured report with severity-ranked findings, file locations, and actionable remediation steps.
When to use
- Before committing or pushing code
- When reviewing third-party contributions or PRs
- As part of a periodic security audit of the codebase
- After AI-assisted code generation to verify no secrets or vulnerabilities were introduced
1---2name: audit-code3description: Security-focused code review for hardcoded secrets, dangerous calls, and common vulnerabilities4---5
6# audit-code -- Project Code Security Review
7
8Security-focused code review of project source code. Covers OWASP-style vulnerabilities, hardcoded secrets, dangerous function calls, and patterns relevant to AI-assisted development.
9
10## What to do
11
12Run the auditor against the target path:
13
14```bash
15python3 "$SKILL_DIR/scripts/audit_code.py" "$ARGUMENTS"
16```
17
18If `$ARGUMENTS` is empty, default to `$PROJECT_ROOT`.
19
20## What it checks
21
22- **Hardcoded secrets** -- API keys (AWS, GitHub, Stripe, OpenAI, Slack), tokens, private keys, connection strings, passwords
23- **Dangerous function calls** -- eval, exec, subprocess with shell=True, child_process.exec, pickle deserialization, system(), gets(), etc.
24- **SQL injection** -- String concatenation/interpolation in SQL queries
25- **Dependency risks** -- Known hallucinated package names, unverified installations
26- **Sensitive files** -- .env files committed to git, credential files in repo
27- **File permissions** -- Overly permissive chmod patterns
28- **Exfiltration patterns** -- Base64 encode + network send, DNS exfiltration, credential file reads
29
30## Output
31
32Structured report with severity-ranked findings, file locations, and actionable remediation steps.
33
34## When to use
35
36- Before committing or pushing code
37- When reviewing third-party contributions or PRs
38- As part of a periodic security audit of the codebase
39- After AI-assisted code generation to verify no secrets or vulnerabilities were introduced
modbender